Why Smart Contracts Reported as Vulnerable were not Exploited?

Abstract

<p>As smart contracts process digital assets, their security is essential for blockchain applications. Many approaches have been proposed to detect smart contract vulnerabilities. Studies show that few of the reported vulnerabilities are exploited and hypothesize that many of the reported vulnerabilities are false positives. However, no follow-up study is performed to confirm the hypothesis and understand why the reported vulnerabilities are not exploited. In this study, we first collect 136,969 unique real-world smart contracts and analyze them using four vulnerability detectors, namely Oyente, SmartCheck, Slither, and SolDetector. Then, we apply Strauss’ grounded theory approach to manually analyze the source code of the smart contracts reported as vulnerable to recognizing false positives and understand the reasons for false results. In addition, we analyze the transaction logs of the smart contracts reported as vulnerable to identifying and understanding their exploitations. Our results show that 75.37% of the 4,364 smart contracts reported as vulnerable are false positives, and eleven reasons are causing the false positives. After analyzing the 4,106,134 transaction logs of the contracts reported as vulnerable, we find that vulnerabilities of only 67 (0.015%) of the contracts have been exploited in history. We also identify six reasons for demotivating and preventing the attackers from exploiting the vulnerabilities. Our results reveal that state-of-the-art smart contract vulnerability detectors primarily treat the smart contracts as yet another application developed using Object Oriented (OO) languages when analyzing and reporting the smart contract vulnerabilities. Without considering the specific design principles of the Solidity programming language and the characteristics of smart contracts' application scenarios and execution environments, many of the reported vulnerabilities are not exploitable or not cost-effective to be exploited by adversaries. </p>

SoliTester: Detecting exploitable external‐risky vulnerability in smart contracts using contract account triggering method

“…Most of them focus on identifying vulnerabilities without distinguishing whether the vulnerabilities are exploitable. 14 F I G U R E 1 (A-C) The process by which an attacker exploits the vulnerabilities RE, UcC, and TO. Static detectors, for example, Oyente, 8 SmartCheck, 17 Slither, 24 Clairvoyance, 18 SoliDetector, 25 mainly compare the target SC with the vulnerable code pattern at the source code level.…”

“…The categories of unexploitable vulnerabilities are explained below, which are based on the reasons for not being able to exploit SC vulnerabilities concluded from an empirical study. 14 • CO. Critical operations include transfer, state variable change, and return value that may affect contract execution. If the reported vulnerability does not involve critical operations, the vulnerability cannot cause any harm and is, therefore, unexploitable.…”

“…If the vulnerability in the vulnerable SC cannot be exploited by attackers or cause security compromises, it is unexploitable . The blockchain security mechanisms and application scenarios of the blockchain technology prevent some vulnerabilities from being exploitable 14 …”

“…The blockchain security mechanisms and application scenarios of the blockchain technology prevent some vulnerabilities from being exploitable. 14 SOTA static detectors, for example, Oyente, 8 Zeus, 15 Securify, 16 SmartCheck, 17 Clairvoyance, 18 analyze the SCs at the source code or bytecode level as an EOA user. They usually miss interactions between the target SC and CAs, resulting in missing external-risky vulnerabilities.…”

“…14 In summary, existing SC vulnerability detectors are insufficient to exploit the external-risky vulnerabilities using CAs and have weaknesses to differentiate exploitable from unexploitable. 14 Precise detection of external-risky vulnerabilities, especially exploitable ones, is critical for developers and security engineers to prioritize efforts to mitigate emerging and critical risks. Our study aims to address the weaknesses of the SOTA SC vulnerability detector by answering the research question: How to effectively and efficiently detect exploitable external-risky vulnerabilities?…”